[Owasp-board] FW: Axfr on owasp.org
larry.casey at owasp.org
Fri Nov 13 15:42:12 UTC 2009
------ Forwarded Message
From: Laurence Casey <larry.casey at aspectsecurity.com>
Date: Fri, 13 Nov 2009 10:36:48 -0500
To: Tom Brennan - OWASP <tomb at owasp.org>, David Campbell
<dcampbell at owasp.org>
Cc: Kate Hartmann <kate.hartmann at owasp.org>, Dinis <dinis at ddplus.net>, OWASP
Foundation Board List <owasp-board at lists.owasp.org>
Conversation: Axfr on owasp.org
Subject: Re: Axfr on owasp.org
Thanks for pointing this out. I did discuss this with our 3rd party DNS
provider and they refused to turn off zone transfers a month ago. Going
third party does not guarantee a secure environment, in fact the opposite is
As for allowing zone transfers, I don¹t think it¹s embarrassing at all.
Using DNS as a security mechanism would be more embarrassing. We have
nothing to hide in our DNS configuration. I do agree that not allowing them
would be better, but in this case, my hands are tied as the provider is not
On 11/13/09 7:52 AM, "Tom Brennan - OWASP" <tomb at owasp.org> wrote:
> Jabra reported this over a month ago discussed with Jeff Williams - this is
> another reason to move to a 3rd party hosting solution.
> On Thu, Nov 12, 2009 at 4:43 PM, David Campbell <dcampbell at owasp.org> wrote:
>> Hey speaker in this talk just mentioned that owasp.org <http://owasp.org>
>> permits zone xfers.
>> Can you get that disabled? Pretty embarrasing
------ End of Forwarded Message
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Owasp-board